As I understand there no percent or auto and it now expects only rate, needs to check
vyos@r14# set qos policy shaper test default bandwidth Possible completions: <number> Bits per second <number>bit Bits per second <number>kbit Kilobits per second <number>mbit Megabits per second <number>gbit Gigabits per second <number>tbit Terabits per second <number>
@Jimz Which lease time are you useing?
starts 5 2023/03/03 02:09:13; ends never;
With default config I see something like
lease 192.0.2.10 {
starts 5 2023/03/03 08:07:15;
ends 6 2023/03/04 08:07:15;
...Try the latest rolling release
In T5041#143810, @fernando wrote:Could we use something like Dannil proposes? https://vyos.dev/T4883 , as you said FRR staticd don't allow this option but it could be useful when we have different mtu over the interface.
Cannot reproduce it with this configuration (VyOS 1.4-rolling-202302280651, don't have a lot of file descriptors):
set protocols bfd peer 192.0.2.5 multihop set protocols bfd peer 192.0.2.5 source address '192.0.2.1' set protocols bfd peer 192.0.2.6 multihop set protocols bfd peer 192.0.2.6 source address '192.0.2.1' set protocols bfd profile BBR interval multiplier '3' set protocols bfd profile BBR interval receive '350' set protocols bfd profile BBR interval transmit '350'
The thing is, we don't use iproute2 commands for adding a route. We use FRR staticd for it. As an exception failover route that uses iproute2 commands
FRRouting 8.4.2 doesn't have such option
r14(config)# ip route 192.0.2.1/32 203.0.113.1
<cr>
(1-255) Distance value for this route
INTERFACE IP gateway interface name
dum0 eth0 eth1 eth2 lo veth0 veth1 wg0
Null0 Null interface
color SR-TE color
label Specify label(s) for this route
nexthop-vrf Specify the VRF
table Table to configure
tag Set tag for this route
vrf Specify the VRFshow vpn ipsec remote-access shows only accel-ppp l2tp, pptp https://github.com/vyos/vyos-1x/blob/current/src/op_mode/show_vpn_ra.py
PR for 1.3 https://github.com/vyos/vyos-build/pull/316
For 1.4
vyos@r14# run show version all | match ocser ii ocserv 1.1.6-3 amd64 OpenConnect VPN server compatible with Cisco AnyConnect VPN [edit] vyos@r14#
@Nova_Logic Is this bug still active?
It still requires testing
who can test if this feature works as expected?
@zsdc Can we close it?
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1859
Done in T4014
Openconnect
[edit] vyos@r14# set vpn openconnect network-settings push-route 100.64.22.0/24 [edit] vyos@r14# commit [ vpn openconnect ] /usr/libexec/vyos/conf_mode/vpn_openconnect.py:32: DeprecationWarning: 'crypt' is deprecated and slated for removal in Python 3.13 from crypt import crypt, mksalt, METHOD_SHA512
There is missed the command tc qdisc add dev eth0 handle ffff: ingress
vyos@r14# tc qdisc show dev eth0 qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1 [edit] vyos@r14# [edit] vyos@r14# tc filter add dev eth0 parent ffff: protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress redirect dev ifb0 Error: Parent Qdisc doesn't exists. We have an error talking to the kernel [edit] vyos@r14#
Try the latest rolling release
PR https://github.com/vyos/vyos-1x/pull/1853
vyos@r14:~$ generate public-key-command user foo path https://github.com/xxxxx.keys # To add this key as an embedded key, run the following commands: configure set system login user foo authentication public-keys github@39e9c9ba-408d-4b4b-9aa6-d07f531285bf key xxxxx set system login user foo authentication public-keys github@39e9c9ba-408d-4b4b-9aa6-d07f531285bf type ssh-rsa set system login user foo authentication public-keys github@4732d9b0-4bc5-47d1-9028-0e68348a932f key xxxxx set system login user foo authentication public-keys github@4732d9b0-4bc5-47d1-9028-0e68348a932f type ssh-rsa set system login user foo authentication public-keys github@a93a85ba-5b63-4c3a-a589-2e82da7c8f1f key xxxxx set system login user foo authentication public-keys github@a93a85ba-5b63-4c3a-a589-2e82da7c8f1f type ssh-rsa commit save exit vyos@r14:~$
Do those keys always without an "identifier"?
I mean foo@localhost
ssh-rsa AAA....
PR https://github.com/vyos/vyos-1x/pull/1842
vyos@r14:~$ /usr/libexec/vyos/tests/smoke/cli/test_interfaces_openvpn.py test_openvpn_client_interfaces (__main__.TestInterfacesOpenVPN.test_openvpn_client_interfaces) ... ok test_openvpn_client_verify (__main__.TestInterfacesOpenVPN.test_openvpn_client_verify) ... ok test_openvpn_options (__main__.TestInterfacesOpenVPN.test_openvpn_options) ... ok test_openvpn_server_net30_topology (__main__.TestInterfacesOpenVPN.test_openvpn_server_net30_topology) ... ok test_openvpn_server_subnet_topology (__main__.TestInterfacesOpenVPN.test_openvpn_server_subnet_topology) ... ok test_openvpn_server_verify (__main__.TestInterfacesOpenVPN.test_openvpn_server_verify) ... ok test_openvpn_site2site_interfaces_tun (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_interfaces_tun) ... ok test_openvpn_site2site_verify (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_verify) ... ok
secret has been deprecated
static key mode (non-TLS) is no longer considered "good and secure enough" for today's requirements. Use TLS mode instead. If deploying a PKI CA is considered "too complicated", using --peer-fingerprint makes TLS mode about as easy as using --secret.https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst
Config VyOS:
set interfaces openvpn vtun5001 local-address 203.0.113.1 set interfaces openvpn vtun5001 mode 'site-to-site' set interfaces openvpn vtun5001 remote-address '192.0.2.5' set interfaces openvpn vtun5001 shared-secret-key 'ovpn_test' set pki openvpn shared-secret ovpn_test key '9caf354e0f313b3a671d01e62ea2b512346a651dd30a9e51d6c45dc1031f1b0931eabdf7a0ddcbe1a147ff882ccce35dcb5e1d4d6ddb5e909ca012a8d8e16fe50dd332005dff9a836a2852f36e84e27bad07993a8094c56fb0553866ef74c6c5cc6ddb8f4673d3ff300c48068b944bd8ba1100d41f91d156bcd2629ff39837ddcb34d93147a4aabc7e6ad95d5800c82c8ab60ba302d6625a3b26fbfe183fd6c06d884be44edde344fd0ac91a33064529e010eba0c0f495fa44519fd98adb97452a27fb3340bc20efadd68c9538aa4a238c9f58f542e3571ec78790fdd03e678e18631b82edb9358a2c55ce581d68b71881cad0d0419d4cc58c13641f84281260' set pki openvpn shared-secret ovpn_test version '1'
In T5022#143112, @syncer wrote:@Viacheslav can you see what auth modes supported by keepalive
also I think we don't need to configure bothset high-availablilty vrrp global notification_email foo@bar.com set high-availablilty vrrp global notification_email_from foo@bar.comor that is destination and from ?